ClawHub
Back to skill

Security audit

Nodecoda Workflow - Dify

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed NodeCoda/Dify workflow authoring integration with expected external build and workflow-generation behavior.

Before installing, expect this skill to use the @nodecoda/skill npm package, register a NodeCoda MCP server, send .ncoda Source to NodeCoda or try.nodecoda.com for builds, and write build outputs beside the source. Do not put secrets in Source or prompts, and review any generated workflow's model providers, tools, and HTTP endpoints before deploying it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The workflow sends user-provided content to a generic external LLM endpoint even though the skill is described as using the authenticated NodeCoda MCP service. In this context, that creates an unjustified data-flow boundary: user prompts may be disclosed to a third-party model provider without clear necessity, policy alignment, or trust guarantees.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The workflow makes a direct HTTP request to an external site that is not part of the stated NodeCoda MCP-focused purpose. Even though this appears to be a demo of error handling, it expands the skill's network reach and can transmit context or trigger unreviewed external interactions outside the expected trust boundary.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The code permits arbitrary external web access via http() without any visible justification connected to the skill's declared workflow scope. In an authenticated development skill, unnecessary outbound access increases the attack surface and may enable data leakage or unintended dependency on external services.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The skill content includes Chinese-only operational instructions without any indication that the user requested or consented to a language switch. This can cause the agent to respond in an unexpected language, reducing user comprehension and making it easier to obscure important build, security, or credential-handling details in a multilingual workflow.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code forwards the user's query directly to an external LLM, but the file contains no user-facing disclosure that their input leaves the local skill boundary. In a development or diagnostic skill context, user queries may contain proprietary source code, build logs, or secrets, making silent transmission to an outside service a meaningful privacy and confidentiality risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The workflow sends raw user-provided essay text to an external LLM service, which is a real privacy and data-governance concern when there is no visible notice, consent, or minimization step. In this skill context, the essay may contain personal or sensitive student information, and the authenticated MCP/service setting makes disclosure to a third party more consequential rather than less.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
User input is sent to an LLM service, and the workflow also contacts an external HTTP endpoint, but there is no visible user-facing disclosure or consent mechanism. This is dangerous because prompts, project content, or system-derived context may leave the local environment without the user's awareness, creating privacy and compliance risks.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The workflow fetches remote web content and forwards it to an LLM, which creates a data-flow from an external source to a third-party model endpoint. Even though the URL is hardcoded and appears non-sensitive, this behavior can expose fetched content to external processing without any disclosure, and in other contexts could enable prompt-injection or unintended transmission of proprietary data.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The skill hard-codes a Chinese user-facing phrase for lightweight mode without user opt-in. This can override the user's language preference, create misleading or inaccessible output, and reduce user control over agent behavior, especially in multilingual or compliance-sensitive contexts.

External Transmission

Medium
Category
Data Exfiltration
Content
}) with retry(max: 3, interval: 1s);

    // attempt 捕获操作的物理失败(网络错误、超时等)
    attempt http("GET", "https://api.example.com/quote", {
        "headers": { "Accept": "application/json" }
    }) as page {
        success {
Confidence
86% confidence
Finding
The hardcoded external endpoint causes outbound transmission to a non-local domain. In the context of a NodeCoda workflow skill, this is risky because it introduces an external trust dependency and can expose metadata, usage patterns, or future expanded request content to an uncontrolled service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.